==================================================
CVE-2026-49844 reproduction  |  log4j-api version: 2.25.4-vulnerable
==================================================

--- Path 1: getFormattedMessage(["JSON"]) with scalar Double values ---
  [double-scalar] value=NaN
    JSON output: {"number":NaN}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [double-scalar] value=Infinity
    JSON output: {"number":Infinity}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [double-scalar] value=-Infinity
    JSON output: {"number":-Infinity}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- Path 1: getFormattedMessage(["JSON"]) with double[] arrays ---
  [double-array] value=NaN
    JSON output: {"numbers":[NaN]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [double-array] value=Infinity
    JSON output: {"numbers":[Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [double-array] value=-Infinity
    JSON output: {"numbers":[-Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- Path 1: getFormattedMessage(["JSON"]) with scalar Float values ---
  [float-scalar] value=NaN
    JSON output: {"number":NaN}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [float-scalar] value=Infinity
    JSON output: {"number":Infinity}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [float-scalar] value=-Infinity
    JSON output: {"number":-Infinity}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- Path 1: getFormattedMessage(["JSON"]) with float[] arrays ---
  [float-array] value=NaN
    JSON output: {"numbers":[NaN]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [float-array] value=Infinity
    JSON output: {"numbers":[Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [float-array] value=-Infinity
    JSON output: {"numbers":[-Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- Path 2: asJson(StringBuilder) direct call (protected) ---
  [asJson-direct] value=NaN/Inf/-Inf
    JSON output: {"inf":Infinity,"ninf":-Infinity,"number":NaN}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

==================================================
SUMMARY (2.25.4-vulnerable)
  total cases tested        : 13
  bare NaN/Infinity tokens  : 13
  quoted NaN/Infinity tokens: 0
  JSON parse failures       : 13
==================================================
VERDICT|2.25.4-vulnerable|VULNERABLE|bare=13|quoted=0|parseFail=13